Script to decode .vbe files

Way back when I was first getting into scripting (and VBScript in particular), I discovered that it was possible to encode a VBScript (obfuscate would be a better term really) using the Microsoft Script Encoder (files will have the .vbe extension). This is all well and good, until you lose the original, and need to make changes to the script.

As Roel pointed out in the comments (and was kind enough to provide a source link too), ** I did not write this ** (I just did clean up on the formatting and added usage information).

This script can be used a couple of different ways, this is documented in the script comments. I haven't used this in years, so I've no idea if it still works or not.

Source Code

This script has not been checked by Spiceworks. Please understand the risks before using it.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

'==============================================================================='===============================================================================' SCRIPT........: scriptDecode.vbs ' VERSION.......: 1.5' DATE..........: 11/22/2003' AUTHOR........: Jean-Luc Antoine' LINK..........: http://www.interclasse.com/scripts/decovbe.php' ALTERED BY....: Joe Glessner' DESCRIPTION...: Decodes scripts encoded with screnc.exe. Usable with ' Wscript by dragging an encoded script onto this one. If done' this way, only the first 100 lines (or so) of the script ' will be displayed.' If run using Cscript.exe the entire output will be ' displayed.' This script can be used to output the decoded script to a ' file using Cscript.exe by calling it with the following' syntax:'' cscript [Path]\scriptDecoder.vbs [Path]\<filename> >> output.txt ''==============================================================================='==============================================================================='**Start Encode**'==============================================================================='# START <CODE>'===============================================================================optionexplicit'---------------------------------------------------------------------------'# Declare variables'---------------------------------------------------------------------------DimoArgs,NomFichier'---------------------------------------------------------------------------'# Check Arguments'---------------------------------------------------------------------------NomFichier=""SetoArgs=WScript.ArgumentsSelectCaseoArgs.CountCase0'No Arg, popup a dialog box to choose the fileNomFichier=BrowseForFolder("Choose an encoded file",&H4031,&H0011)Case1IfInstr(oArgs(0),"?")=0Then'-? ou /? => aideNomFichier=oArgs(0)EndIfCaseElseWScript.Echo"Too many parameters"EndSelectSetoArgs=Nothing'---------------------------------------------------------------------------'# Decode the file and output the results'---------------------------------------------------------------------------IfNomFichier<>""ThenDimfsoSetfso=WScript.CreateObject("Scripting.FileSystemObject")Iffso.FileExists(NomFichier)ThenDimfic,contenuSetfic=fso.OpenTextFile(NomFichier,1)Contenu=fic.readAllfic.closeSetfic=NothingConstTagInit="#@~^"'#@~^awQAAA==ConstTagFin="==^#~@"'& chr(0)DimDebutCode,FinCodeDoFinCode=0DebutCode=Instr(Contenu,TagInit)IfDebutCode>0ThenIf(Instr(DebutCode,Contenu,"==")-DebutCode)=10Then'If "==" follows the tagFinCode=Instr(DebutCode,Contenu,TagFin)IfFinCode>0ThenContenu=Left(Contenu,DebutCode-1)&_Decode(Mid(Contenu,DebutCode+12,FinCode-DebutCode-12-6))&_Mid(Contenu,FinCode+6)EndIfEndIfEndIfLoopUntilFinCode=0WScript.EchoContenuElseWScript.EchoNomfichier&" not found"EndIfSetfso=NothingElseWScript.Echo"Please give a filename"WScript.Echo"Usage : "&wscript.fullname&" "&WScript.ScriptFullName&_" <filename>"EndIf'==============================================================================='# Functions'==============================================================================='---------------------------------------------------------------------------'# Name................: Decode()'# Use.................: Decode(Chaine)'# Purpose.............: Reverse the encoding done by screnc.exe.'---------------------------------------------------------------------------FunctionDecode(Chaine)Dimse,i,c,j,index,ChaineTempDimtDecode(127)ConstCombinaison="1231232332321323132311233213233211323231311231321323112331123132"Setse=WSCript.CreateObject("Scripting.Encoder")Fori=9to127tDecode(i)="JLA"NextFori=9to127ChaineTemp=Mid(se.EncodeScriptFile(".vbs",string(3,i),0,""),13,3)Forj=1to3c=Asc(Mid(ChaineTemp,j,1))tDecode(c)=Left(tDecode(c),j-1)&chr(i)&Mid(tDecode(c),j+1)NextNext'Next line we correct a bug, otherwise a ")" could be decoded to a ">"tDecode(42)=Left(tDecode(42),1)&")"&Right(tDecode(42),1)Setse=NothingChaine=Replace(Replace(Chaine,"@&",chr(10)),"@#",chr(13))Chaine=Replace(Replace(Chaine,"@*",">"),"@!","<")Chaine=Replace(Chaine,"@$","@")index=-1Fori=1toLen(Chaine)c=asc(Mid(Chaine,i,1))Ifc<128Thenindex=index+1If(c=9)or((c>31)and(c<128))ThenIf(c<>60)and(c<>62)and(c<>64)ThenChaine=Left(Chaine,i-1)&Mid(tDecode(c),Mid(Combinaison,_(indexmod64)+1,1),1)&Mid(Chaine,i+1)EndIfEndIfNextDecode=ChaineEndFunction'---------------------------------------------------------------------------'# Name................: BrowseForFolder()'# Use.................: BrowseForFolder(ByVal pstrPrompt, ByVal '# pintBrowseType, ByVal pintLocation)'# Purpose.............: Locate the encoded script using Shell.Application'---------------------------------------------------------------------------FunctionBrowseForFolder(ByValpstrPrompt,ByValpintBrowseType,ByValpintLocation)DimShellObject,pstrTempFolder,xSetShellObject=WScript.CreateObject("Shell.Application")OnErrorResumeNextSetpstrTempFolder=ShellObject.BrowseForFolder(&H0,pstrPrompt,pintBrowseType,pintLocation)BrowseForFolder=pstrTempFolder.ParentFolder.ParseName(pstrTempFolder.Title).PathIfErr.Number<>0ThenBrowseForFolder=""SetpstrTempFolder=NothingSetShellObject=NothingEndFunction'==============================================================================='# END </CODE>'===============================================================================

2 Comments

Hi Joe,
It is a very nice script. One BIG minor on this script.
You are NOT the author of this script. this would be: Jean-Luc Antoine.
http://www.interclasse.com/scripts/decovbe.php
Could you please correct this in the above mentioned script.
Thx

Roel,
You are correct, I did not write this script (French is not my native language).
At a previous job we were all required to "take ownership" of any script put in the production environment by using a standard header. If we were using code we did not have a source for we were to list ourselves as the author (I assume so that they knew who to blame if something went wrong). Consequently I have many scripts in my library that have incorrect author information.
Thank you for taking the time to point out correct author information for this script. I have updated the header information to include correct author information and your link to source.